Sectors where the evidence has to hold

Banks, insurers, payment institutions, e-money firms and market infrastructure operating under supervisory scrutiny. Typical work is DORA operational resilience assessment, ICT third-party risk review, threat-led penetration testing, PCI DSS scope and readiness assessment, and the evidence packages a supervisor asks to see.

Industrial operators, utilities, transport and logistics organisations where operational technology and safety sit alongside information systems. Typical work is NIS2 applicability and gap assessment, OT and industrial control system architecture vetting, supplier vetting across engineering supply chains, and incident response planning that accounts for physical process.

Software, hardware and connected-product organisations that ship to European markets. Typical work is Cyber Resilience Act readiness for products with digital elements, secure development and DevSecOps assessment, cloud and identity architecture vetting, penetration testing across product and platform, and AI system vetting where models form part of the product.

Law firms, accountancy practices, advisory firms and other custodians of confidential client material. Typical work is ISO/IEC 27001 implementation and internal audit, data protection and GDPR programme review, personnel security vetting, and technical assurance over the collaboration and document platforms that hold privileged information.

National authorities, agencies, and European institutions and bodies, together with the programmes they fund. Typical work is audit of EU-funded projects, assessment against ENISA and European Commission frameworks, security governance and risk methodology, and independent assurance over programmes delivered by third parties.

Organisations that bring in certified specialists for client programmes and bids. Typical work is named specialist input to client-facing assessments, independent technical review inside a wider delivery programme, and certification-holder participation in tender and framework submissions.